How to verify that Security Gateway and/or Security Management Server can access Check Point servers?

Solution

Security Gateways and Security Management Server require access to the Internet (either directly, or via configured proxy) for various Software Blades.

Important Notes:

• Make sure the Access Control Policy for Security Gateways does not drop / block the connections to the required Check Point servers.

If you disabled the default Implied Rules, then you must follow sk179346 - Configuring Explicit Rules instead of Implied Rules.

• Make sure the NAT Policy for Security Gateways does not translate the connections to the required Check Point servers.

• In Gaia OS, use the " curl_cli" command.

Notes:

• To configure proxy settings, do one of these:
  • Configure the proxy server locally in Gaia OS settings as described in the Gaia Administration Guide for your version > chapter "System Management" > section "Proxy".
  • Configure the proxy server in SmartConsole:
    • In Menu > option "Global properties" > page "Proxy" (applies to all objects).
    • In the Security Gateway / Management Server object > section "Network Management" > page "Proxy" (overrides the global proxy configuration).
• Refer to sk110779 - "curl: (900) servercert: Error - server certificate validation failed!" when running "curl_cli" command.
• For each of the curl_cli commands, add the option --cacert $CPDIR/conf/ca-bundle.crt to prevent the issue in sk110779.
• In Gaia Embedded OS (all versions), use the " wget" command.

Notes:

• To configure proxy settings, do one of these:

  • In the Locally Managed mode and Centrally Managed mode - configure the proxy server locally in Gaia OS settings as described in the Spark Firewall Locally Managed Administration Guide for your version ( R81.10.x, R80.20.x, R77.20.x) > chapter "Managing the Device" > section "Configuring the Proxy Server".

• In the Centrally Managed mode only - configure the proxy server in SmartConsole > the Security Gateway object > section "Topology" > page "Proxy" (overrides the proxy settings in SmartConsole > Global Properties > page "Proxy").

• If you configured an IPv6 address on an external interface on your Security Gateway / Security Management Server, then the Access Control policy must also allow the IPv6 connections to domains listed below.

• All the domains below are part of the new Updatable object "Check Point Services".

For more information about Updatable objects, see sk131852.

• You can also check and subscribe to updates on the Services status page.

The table below lists the relevant connectivity tests.

Enter the string to filter this table:

Additional Notes:

• Specific IP addresses for the servers are not provided because they vary by region and are subject to change.

• There are some Check Point Services / Software Blades that require Proxy configuration on top of the Proxy global property configured in the object of your Security Management Server / Domain Management Server, so that connections to sigcheck.checkpoint.com will be able to pass through your Proxy server.

Show / Hide Examples from R7X SmartDashboard

Note: Check if you have one those blades enabled and configure proxy settings for each of them.

• Endpoint Compliance:

1. Go to the "Mobile Access" tab
   2. Expand the "Endpoint Security On Demand"
   3. Click on the "Endpoint Compliance Updates"
   4. In the "Automatic Update" section, click on the "Configure..." button
   5. Go to the "Proxy" tab

Example:

• Legacy URL Filtering:

1. Go to the "Application & URL Filtering" tab
   2. Expand the "Legacy URL Filtering"
   3. Click on the "Legacy URL Filtering Policy"
   4. Click on the "Automatic updates" link
   5. Go to the "Proxy" tab

Example:

• Traditional Anti-Virus and UTM-1 Edge devices:

1. Go to the "Threat Prevention" tab
   2. Expand the "Traditional Anti-Virus"
   3. Click on the "Database Updates"
   4. In the "Automatic Update" section, click on the "Configure..." button
   5. Go to the "Proxy" tab

Example:

Revision History